ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
ROKSO
The Register of Known Spam Operations
Brian Kramer / Expedite Media Group

Evidence Menu:

Brian Kramer / Expedite Media Group Index


Country: United States
State: Illinois
Massive spamhaus. Kicked off of MCI, Anet, Mzima, Uninet, SingTel, Yipes, Servercentral, WilTel, Triara in Mexico, Broadwing, a Panamanian host, Schlund and lastly Speakeasy - just between Jul-Oct 2005!


Brian Kramer / Expedite Media Group SBL Listings History
Current SBL Listings
Archived SBL Listings

Busy breaking CAN-SPAM law in 2004/2005


Subject: Re: Expedite Media - new network

Steve Marlow wrote:


>
> AS33012
> Expedite Marketing Corporation
> 1911 Glacier Park Ave Ste 574
> Naperville IL 60540 US
> RegDate: 10 Sep 2004
> Updated: 10 Sep 2004
> +1 630-737-0670
> admin@emgmail.com
>
>
> Spammer also has ARIN resources:
>
> 209.203.192.0/19
> Expedite Marketing Corporation
> 1911 Glacier Park Ave Ste 574
> Naperville IL 60540 US
> RegDate: 03 Mar 2005 <-- NEW REGISTRATION
> Updated: 03 Mar 2005
> +1 630-737-0670
> abuse@emgmail.com
>

Domain Name: emgmail.com
Registrar Name: Alldomains.com
Registrar Whois: whois.alldomains.com
Registrar Homepage: http://www.alldomains.com
Administrative Contact:
Expedite Media Group (NIC-1586933) Expedite Media Group
245 West Roosevelt Rd
West Chicago IL 60185
US
abuse[]expeditemg.com
+1.6308768066
Fax- +1.6308768146

http://www.google.ca/search?hl=en&q=630-876-8066

Maybe this is where the Vietnam P&T spam link comes in... might as well
offshore with your homeland:

CORPORATION FILE DETAIL REPORT
Entity Name EXPEDITE MEDIA GROUP INCORPORATED
File Number 62015373
Status NOT GOOD STANDING
Entity Type CORPORATION
Type of Corp DOMESTIC BCA
Incorporation Date (Domestic) 02/04/2002
State ILLINOIS
Agent Name VIET D NGUYEN
Agent Change Date 08/27/2003
Agent Street Address 1612 OGDEN AVE
President Name & Address VIET NGUYEN 1612 OGDEN AVE LISLE 60532
Agent City LISLE
Secretary Name & Address SAME
Agent Zip 60532-0000
Duration Date PERPETUAL
Annual Report Filing Date 00/00/0000
For Year 2005

From fudo's OP:
whois -h whois.apnic.net 203.162.126.212
inetnum: 203.162.0.0 - 203.162.255.255
netname: VNPT-VNNIC-VN
country: VN
descr: Vietnam Posts and Telecommunications (VNPT)
descr: 23 Phan Chu Trinh st., Hanoi capital, Vietnam
admin-c: NXC1-AP
tech-c: KNH1-AP
status: ALLOCATED PORTABLE
changed: hm-changed@vnnic.net.vn 20041011
mnt-by: MAINT-VN-VNNIC
mnt-lower: MAINT-VN-VNPT
source: APNIC

Wonder if their "partners" are aware of their "business status"...
http://www.expeditemg.com/htm/partners.htm

or if all the lawyer's know about the bogus registrations using law office contact information for ---domain temporarily removed on advice of counsel--- etc...
http://www.expeditemediagroup.com/AttorneyWebMarketing.htm
http://www.expeditemediagroup.com/LawFirmWebDesignLawyerWebsiteDesignAttorneyWebDesign.htm

Also, gotta love it: http://www.expedite-bulletproof-server.com/
http://www.google.ca/search?hl=en&q=630-876-8255


03/05/05 15:31:10 dns WWW.EXPEDITE-BULLETPROOF-SERVER.COM
Mail for WWW.EXPEDITE-BULLETPROOF-SERVER.COM is handled by
EXPEDITE-BULLETPROOF-SERVER.COM
Canonical name: EXPEDITE-BULLETPROOF-SERVER.COM
Aliases:
WWW.EXPEDITE-BULLETPROOF-SERVER.COM
Addresses:
69.60.1.207

route: 69.60.0.0/20
descr: PNAP-CHG equinix-third
origin: AS33012
mnt-by: INAP-MAINT-RADB
changed: twomack@internap.com 20050102
source: RADB

See DR's detailed report here:
http://groups.google.ca/groups?selm=PdidnSX9lorIJj3cRVn-2g%40rogers.com

________

Subject: Someone got caught


<Quote>
November 20, 2004
My Honey Pot catches first spam harvester

It's been a week since I installed a hidden software trap for
those who illegally harvest Web sites for e-mail addresses
that are then used by spammers.


Here's the original post describing it, part of
Project Honey Pot, an ambitious new weapon in the war against
spam spearheaded by Matt Prince, CEO of an anti-spam
organization called Unspam and an adjunct law professor at
Chicago's John Marshal Law School.

Prince tells me my first harvester visited from the
IP address: 69.6.66.17. Here's the page that describes the
harvester visit and its details.

It happened Tuesday, at 7:02 pm. The harvester moved through my
site, looking for e-mail addresses. That's where the Honey Pot
came in. It gave the harvester a control address that Prince
set up. When spam is received at that address, it links directly
back to the harvester.

Whoever is doing the harvesting at this site appears to be running
the software on a machine in New Jersey on a connection provided
by Comcast. You can find the whois information on the IP here.

Pricne says it could be that this is a compromised zombie machine.
But the fact that the same IP has acted as a harvester over a
3 week period - he's recorded visits from that IP address to
other Project Honey Pot sites - makes him suspicious that
there's a real user behind that Comcast connection who is doing
the harvesting. It's worth noting that this IP is not listed
in most of the big spammer-tracking databases and doesn't appear
to be sending ANY spam itself. For example, Spamhaus,
SenderBase or dnsstuff.

More evidence that the harvester is not a zombie machine comes
from the fact that it is associated with a single mail server
(69.6.66.17). Details on that mail server can be found here:
http://www.projecthoneypot.org/ip_inspector.php?iph=eb9d8ceabfde9c68f110b995df9a4f12

It looks like the spam messages being sent regard a tax
deduction scheme involving donated cars and a prescription
drug seller.

Here's where it gets interesting.
Unlike the harvester, there's lots of information about the
outfit behind the spam. The whois information points to an
Illinois-based direct marketing company, Expedite Marketing
Corporation.

Expedite has a reputation and, in fact, is alleged to be working
with Scott Richter and a number of other high-profile spammers.
However, their corporate presence makes them out to be a
legitimate direct email marketer, honoring opt-outs, complying
with CAN-SPAM, and, of course, not harvesting. More information
is available on the company's website.
http://www.expedite-internet-marketing.com/about_us.htm

According to their site, they do marketing for a major
Chicago-area car dealer and a local bank, Prince wonders what the
reaction would from their legitimate customers if they knew of some
of the other sites of the business. For example, run off the
same server, Expedite also hosts Xxxpedite, Adultdesignwebsite
and Adult-design-website.
http://www.xxxpedite.com/
http://www.adultdesignwebsite.com/
http://www.adult-design-website.com/

There's also evidence, from the other sites they run, of their
very active interest in collecting e-mail addresses
- Expedite-email-collector, Buy-email-list and Bulkemailbroadcasting.
http://www.expedite-email-collector.com/
http://www.buy-email-list.com/
http://www.bulkemailbroadcasting.com/

Just by sending to a harvested email address Expedite could be
violating the law, says Prince. Here is information on the
Federal CAN-SPAM Act's prohibitions on harvesting.

I'll follow up as we identify more of these harvesters.
WIth more than 1,000 sites now working with Project Honey Pot,
this promises to be an interesting weapon in the fight against
spammers. So far, harvesters have grabbed 1,986 Honey Pot e-mail
addresses from the participating sites. Seventy-four of those
control addresses have already received spam messages. That's
led to the identification of 25 harvesters and 51 different
spam servers.
</Quote>
Reference: http://mikesejournal.com/archives/003071.php
===============

Whois: expedite-internet-marketing.com = 69.6.66.4

Registrant: Chuck Farinella (DOM-348536)
8280 Janes Avenue #20
Woodridge, IL, 60517 US
Administrative and Technical Contact:
Chuck Farinella (NIC-1585723)
8280 Janes Avenue #20
Woodridge, IL, 60517 US
webmaster@amgcorp.net
+1. 847-298-9911
Created on..............: 2004-Jan-07.
Expires on..............: 2005-Jan-07.
Record last updated on..: 2004-Mar-25 09:45:40.
Domain servers in listed order:
NS.X-DNSSECURE.NET 69.6.66.8
NS.Z-DNSSECURE.NET 69.6.66.2
==============

Phonebook results for 847-298-9911
American Merchandise Group Inc,
(847) 298-9911,
30 E Oakton St, Des Plaines, IL 60018
==============

Whois: amgcorp.net = 69.6.66.4

Registrant: Chuck Farinella (DOM-302428)
8280 Janes Avenue #20A
Woodridge IL 60517, US
Administrative Contact:
Chuck Farinella (NIC-1479679) Chuck Farinella
8280 Janes Avenue #20A
Woodridge IL 60517, US
domains@expeditemg.com
+1.8472989944 Fax- -
Technical Contact, Zone Contact:
Brian Kramer (NIC-1479681) Expedite Media Group
1612 Ogden Ave
Lisle IL 60532, US
domains@expeditemg.com
1 630-737-0686 Fax- 1 630-737-0665
Created on..............: 2001-Apr-18.
Expires on..............: 2005-Apr-18.
Record last updated on..: 2004-Nov-09 14:10:02.
Domain servers in listed order:
NS.X-DNSSECURE.NET 69.6.66.8
NS.Z-DNSSECURE.NET 69.6.66.2
==========================

<Quote>
American Merchandise Group is one of the fastest growing
promotional products companies in the country. We specialize
in the Sales and Purchasing of closeouts, overstock, takedowns
and obsolete products. With a proven record of working with
Large and Small retailers across the country and a
40,000 Square foot facility located in Des Planes, Illinois,
we can meet all of your wholesale and retail needs.

<snip>

A.M.G. Company Profile
Conceived in 1985, by our president Chuck Farinella,
AMG has been exceeding our goals of providing retailers and
wholesalers with consistent service and exceptional value.
With our experienced managers and large amount of support
staff we will always be an organization where meeting our
customers' needs is our prime objective.

Contact Information
Our preference is always to be in contact with you by telephone.
When you call, there will always be a live person to answer
all yours questions and inquires (not some machine!).
Please feel free to call us anytime...

Telephone
847-298-9911

FAX
847-557-9005

Postal address
8280 Janes Avenue
#20A Woodridge, IL 60517

Sales Dept
Jan Swiscz - V.P. of sales - 847-298-9933
email: jan@amgcorp.net

Marty Cohen - Account Executive - 847-298-9922
marty@amgcorp.net]

Bob Zagone - Sales - 847-298-9911 ext:20
bob@amgcorp.net

Matt Derrig - Sales Assistant - 847-298-9911 ext:13
matt@amgcorp.net

Buying Dept
Chuck Farinella - President - 847-298-9944
email: dantcorp@cs.com

Webmaster
viet nguyen viet@amgcorp.net
</Quote>
Reference: http://www.amgcorp.net/

Note: Viet Nguyen is listed as the President of
Expedite Media Group Incorporated.
see last link
==========================

Whois: expeditemg.com = 69.6.66.4

Registrant: Expedite Media Group (DOM-240726)
245 West Roosevelt Rd West Chicago, IL 60185 US
Administrative, Technical and Zone Contact:
Expedite Media Group (NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West, Chicago, IL 60185 US
abuse@expeditemg.com
+1.6308768066 Fax- +1.6308768146
Created on..............: 2001-Nov-08.
Expires on..............: 2005-Nov-08.
Record last updated on..: 2004-Nov-08 02:06:58.
Domain servers in listed order:
NS.X-DNSSECURE.NET 69.6.66.8
NS.Z-DNSSECURE.NET 69.6.66.2
============================

WholesaleBandwidth, Inc. WHOLE-2 (NET-69-6-0-0-1)
69.6.0.0 - 69.6.79.255
Expedite Marketing Corporation EXP-BLK-69-6-66-0 (NET-69-6-66-0-1)
69.6.66.0 - 69.6.66.255


OrgName: Expedite Marketing Corporation
OrgID: EMC-67
Address: 1911 Glacier Park Ave Suite 574
City: Naperville
StateProv: IL
PostalCode: 60540
Country: US

NetRange: 69.6.66.0 - 69.6.66.255
CIDR: 69.6.66.0/24
NetName: EXP-BLK-69-6-66-0
NetHandle: NET-69-6-66-0-1
Parent: NET-69-6-0-0-1
NetType: Reassigned
NameServer: NS.X-DNSSECURE.NET
NameServer: NS.Z-DNSSECURE.NET
Comment:
RegDate: 2004-10-04
Updated: 2004-10-04

OrgAbuseHandle: ABUSE684-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-630-737-0670
OrgAbuseEmail: abuse@emgmail.com

OrgTechHandle: TECHN179-ARIN
OrgTechName: Technical
OrgTechPhone: +1-630-737-0670
OrgTechEmail: admin@emgmail.com
# ARIN WHOIS database, last updated 2004-11-20 19:10
===============

Whois: emgmail.com = 69.6.66.4

Registrant: Expedite Media Group (DOM-347608)
245 West Roosevelt Rd West, Chicago IL 60185 US
Administrative, Technical and Zone Contact:
Expedite Media Group (NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West, Chicago IL 60185 US
abuse@expeditemg.com
+1.6308768066 Fax- +1.6308768146
Created on..............: 2003-Dec-31.
Expires on..............: 2004-Dec-31.
Record last updated on..: 2004-Jun-07 11:23:20.
Domain servers in listed order:
NS.X-DNSSECURE.NET 69.6.66.8
NS.Z-DNSSECURE.NET 69.6.66.2
==================

69.6.66.4 - IP hosts 30 Total Domains ...
Showing 1 - 30 out of 30

Domain Name
1 ADULT-DESIGN-WEBSITE.COM
2 ADULTDESIGNWEBSITE.COM
3 ALLSTARSCLUB.COM
4 AMGCORP.NET
5 BULK-EMAIL-BROADCASTING.COM
6 BULKEMAILBROADCASTING.COM
7 BUSINESSREWARDPOINTS.COM
8 BUY-EMAIL-LIST.COM
9 EBJBODYPIERCING.COM
10 EGGHEADHOSTING.COM
11 EMGMAIL.COM
12 EXPEDITE-BULLETPROOF-SERVER.COM
13 EXPEDITE-EMAIL-COLLECTOR.COM
14 EXPEDITE-EMAIL-MARKETING.COM
15 EXPEDITE-INTERNET-MARKETING.COM
16 EXPEDITE-LIVE-CHAT.COM
17 EXPEDITE-WEBSITE-DESIGN.COM
18 EXPEDITE-WEBSITE-HOSTING.COM
19 EXPEDITEBULLETPROOFSERVER.COM
20 EXPEDITELIVEWIRE.COM
21 EXPEDITEMARKETINGCORP.COM
22 EXPEDITEMEDIAGROUP.COM
23 EXPEDITEMG.COM
24 EXPEDITESIMPLICITY.COM
25 EXPEDITEWEBSITEDESIGN.COM
26 MONSTERFIND.NET
27 MSDINST.COM
28 OFFICIALSEKA.COM
29 PAIDOPTIN.COM
30 XXXPEDITE.COM
====================

Whois.internic.net: 69.6.66.8
NS.X-DNSSECURE.NET
NS.CONSUMER-RESOURCE.COM

Whois.internic.net: 69.6.66.2
NS.Z-DNSSECURE.NET
NS1.EINFO-FAST.NET

Server Name: NS1.CONSUMER-RESOURCE.COM
IP Address: 68.23.241.42

Server Name: NS2.CONSUMER-RESOURCE.COM
IP Address: 68.23.241.43
===================

Whois: z-dnssecure.net [no website]

Registrant: Expedite Media Group (DOM-347884)
245 West Roosevelt Rd West, Chicago, IL 60185 US
Administrative, Technical and Zone Contact:
Expedite Media Group (NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West, Chicago, IL 60185 US
abuse@expeditemg.com
+1.6308768066 Fax- +1.6308768146
Created on..............: 2004-Jan-05.
Expires on..............: 2005-Jan-05.
Record last updated on..: 2004-Jan-07 10:01:57.
Domain servers in listed order:
NS.Z-DNSSECURE.NET 69.6.66.2
NS.X-DNSSECURE.NET 69.6.66.8
=======================

Whois: x-dnssecure.net [Host not found]

Registrant: Expedite Media Group (DOM-347883)
245 West Roosevelt Rd West, Chicago, IL 60185 US
Administrative, Technical and Zone Contact:
Expedite Media Group (NIC-1586933)
Expedite Media Group
245 West Roosevelt Rd West, Chicago, IL 60185 US
abuse@expeditemg.com
+1.6308768066 Fax- +1.6308768146
Created on..............: 2004-Jan-05.
Expires on..............: 2005-Jan-05.
Record last updated on..: 2004-Jan-07 10:02:48.
Domain servers in listed order:
NS.Z-DNSSECURE.NET 69.6.66.2
NS.X-DNSSECURE.NET 69.6.66.8
===============

Whois: consumer-resource.com

Registrant: Dave Logan (DOM-266806)
618 Executive Drive
Willowbrook, IL 60527 US
Administrative Contact:
Dave Logan (NIC-1369369) Dave Logan
618 Executive Drive
Willowbrook, IL 60527, US
info@consumer-resource.com
+1. 630-951-7894 Fax- +1. 630-951-7895
Technical Contact, Zone Contact:
Dave Logan (NIC-1369371) Dave Logan
618 Executive Drive, Willowbrook, IL 60527 US
info@consumer-resource.com
+1.6309517894 Fax- +1.6309517895
Created on..............: 2002-Nov-18.
Expires on..............: 2004-Nov-18.
Record last updated on..: 2004-Nov-09 14:14:43.
Domain servers in listed order:
NS1.CONSUMER-RESOURCE.COM 68.23.241.42
NS2.CONSUMER-RESOURCE.COM 68.23.241.43
=================

Last link

Subject: Brian Kramer
Newsgroups: news.admin.net-abuse.email
Date: 2004-03-11 11:09:56 PST
http://groups.google.ca/groups?selm=WP24c.257338%24Qg7.92742%40news04.bloor.is.net.cable.rogers.com


Related URLs

NANAE Post 1
NANAE Post 2


The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is: https://www.spamhaus.org/rokso/evidence/ROK4793/

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy